How This Briefing Works
This report opens with key findings, then maps the gaps between what Factors.ai discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Live website analysis pending
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Factors.ai
- →Audit tag manager deployment for dynamic script loading and third-party calls
- →Review DPA for clarity on identity graph providers and data sharing arrangements
- →Implement consent gate to prevent identification of EU/UK visitors without explicit opt-in
If You're Evaluating Factors.ai
- →Server-side identification to reduce client-side fingerprinting footprint
- →First-party identity resolution using owned data sources only
- →Alternative ABM platforms with transparent matching methodologies
Negotiation Leverage
- →Demand exhaustive list of identity data providers and explicit controls over downstream data sharing
- →Request contractual prohibition on using your visitor data to enrich Factors' identity graph for other customers
- →Negotiate tag manager deployment restrictions requiring approval for new tracking capabilities or third-party integrations
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Fingerprints visitors through interaction patterns, device characteristics, and engagement signals to enable cross-session identification
Identity stitching
Impact: Synchronizes visitor identity across domains and sessions through third-party identity graph integrations
Ignoring CMP signals
PII deanonymization
Container/loader (neutral)
Impact: Injects via GTM to bypass security review and dynamically load additional tracking capabilities without deployment visibility
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
15 detection signatures across scripts, domains, cookies, and network endpoints